Re: [PATCH v3 05/10] drm/mediatek: mtk_dsi: Transfer register offsets to per-SoC const

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] In `mtk_dsi_host_transfer()`, reading from DSI RX data registers incorrectly adds the byte offset `i` to the `reg_main` enum array index rather than the resolved register address, causing out-of-bounds array reads and invalid MMIO access.
--

--- Patch [5]: [PATCH v3 05/10] drm/mediatek: mtk_dsi: Transfer register offsets to per-SoC const ---
commit a32b9a7c67e660488b31bdcea6dd9055c83b92eb
Author: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

drm/mediatek: mtk_dsi: Transfer register offsets to per-SoC const

This commit transfers DSI register offsets to two const arrays to support newer
generation DSI IPs with different register offsets. It separates DSI IP
version-specific registers from SoC-specific ones.

> diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
> index bdb9ea2e7b6f6..4d5cb91c788f6 100644
> --- a/drivers/gpu/drm/mediatek/mtk_dsi.c
> +++ b/drivers/gpu/drm/mediatek/mtk_dsi.c

[ ... ]

> @@ -1297,7 +1432,8 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,
>  	}
>  
>  	for (i = 0; i < 16; i++)
> -		*(read_data + i) = readb(dsi->regs + DSI_RX_DATA0 + i);
> +		*(read_data + i) = readb(dsi->regs +
> +					 dsi->driver_data->reg_main[DSI_RX_DATA0 + i]);

[Severity: High]
Does this code perform an out-of-bounds array read? 

Since DSI_RX_DATA0 is 17 and DSI_MAIN_REG_MAX is 28, the loop will read past 
the end of the reg_main array when i >= 11. Even for smaller values of i, this 
will fetch the base offsets of unrelated registers (like DSI_RX_DATA1, 
DSI_RACK, and DSI_PHY_LCCON) instead of consecutive bytes of the RX payload.

Should the byte offset i be added outside the array subscript instead, like
dsi->driver_data->reg_main[DSI_RX_DATA0] + i?

>  
>  	recv_cnt = mtk_dsi_recv_cnt(read_data[0], read_data);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713130103.34654-1-angelogioacchino.delregno@collabora.com?part=5